About trojan_81

trojan_81 · ‎06-21-2021

Can someone help me break down this portion of a search? Is it saying, look for anything older than 30 minutes? eval recent = if(latest > relative_time(now(),"-30m"),1,0), realLatest = strftime(latest,"%c") | where recent=0

trojan_81 · ‎12-15-2020

To be clear, I am asking if splunk is able to act as a TAXII client so that it can retrieve STIX formatted threat intelligence automatically. Or will this require a 3rd party service like a Threatconnect or Threatstream?

trojan_81 · ‎12-15-2020

Hello Splunk Experts, My organization has splunk cloud and enterprise security. I was wondering if Splunk is capable of acting as a stix/taxii client so that I can enroll with a threat intelligence provider and have those feeds come directly into splunk. I know splunk has a way for me to upload stix/taxii files but that's manual.

trojan_81 · ‎12-08-2020

That helps greatly thank you. With that in mind, what are a few reasons why you would want to implement ES (assume you had the funds)?

trojan_81 · ‎12-07-2020

Hi Splunk Experts, Suppose I only have splunk cloud. Is it NOT possible to set an alert based on a search that correlates events from multiple systems? Such as correlating an event across endpoint and network activity. Is this where Enterprise Security is needed? Or is the answer that one can technically do it without Enterprise security but it would be tougher? Would splunk enterprise have more out of the box correlations than just splunk cloud?

trojan_81 · ‎10-30-2020

Folks, I would like to know what name of index you recommend for o365 audit logs via the Microsoft o365 add-on for splunk. I know it doesn't matter, but I want to go with whatever most people are using.

trojan_81 · ‎10-30-2020

Hello all, My organization is using splunk cloud. I log into splunk cloud to run searches and also access the enterprise security app from there as well. Given the above statement, are the below statements correct? 1. Splunk cloud is doing these roles: indexer and search head 2. Splunk cloud is the same thing as splunk enterprise

trojan_81 · ‎10-30-2020

Two questions regarding Dynamic Data Storage: 1) Within an Index, can I archive a specific sourcetype only or can I only archive the entire index? 2) Let's say Index main has searchable time of 365 days. I select dynamic data storage < Splunk Archive < and specify Archive Retention Period of 365 days. Does that mean when original event data reaches 365 days, it will move to splunk storage as Frozen and be available for another 365 days? Why is there no option to define max size?

trojan_81 · ‎10-30-2020

Hello there. Within splunk cloud, I go to Settings < Indexes. I am looking at my main index. It has a current size of 5TB and a searchable retention time of a year. Questions: 1) How much data can remain on this index before new data starts to overwrite old data? 2) How do I view the configurations of this index such as how long the data waits before it starts going through the aging bucket stage? 3) If searchable retention is a year, does that mean data after a year will go to frozen status?

trojan_81 · ‎10-27-2020

Hi Suppose the device that sent the log to Splunk is logging in US Pacific time. If I run a search like this in splunk: sourcetype=blah Data="*blahdata*" | table _time, Action, Data, Username In reviewing the output of the search, Is _time in US Pacific or the default UTC?

trojan_81 · ‎10-27-2020

How can I view the default index of a user? In other words, if user runs a search within splunk search app and does not specify an index, how do i view which index he will default at?

trojan_81 · ‎04-05-2020

As an o365 admin I have a TLS email connector setup for my splunk cloud instance but I am unable to find the corresponding configurations on the splunk cloud side. It is not within the Settings < Email settings within splunkcloud. Where else may I find the configurations?

trojan_81 · ‎03-16-2020

Rich. Other apps are able to get logs into this Forwarder via REST API and the logs are searchable on splunk cloud indexer. That tells me that the Forwarder is probably ok. I just need a way to show proof so that I can go back to the vendor's app side. Proof will be confirming that the logs are not making it to the Forwarder.

trojan_81 · ‎03-16-2020

makes sense now. thanks rich galloway

trojan_81 · ‎03-16-2020

I have a heavy forwarder onprem installed on a windows OS. I am troubleshooting why logs are not coming into the splunk cloud indexer from a cloud service over API. The api is between my onprem splunk heavy forwarder and the cloud service. I suspect the problem is on the cloud service side. I need a way to tell if the logs are even making it to my heavy forwarder. Is there a way to tail a running log on the heavy forwarder? Also I am referring to the onprem slunk server as a heavy forwarder. Is that the proper term? It sends data to the cloud indexer.

trojan_81 · ‎03-16-2020

Richgalloway, Can you think of a use case (or is it even possible) for splunk cloud to query a heavy forwarder that is onprem?

trojan_81 · ‎03-16-2020

In a typical splunk cloud environment do logs get forwarded from onprem directly to the cloud indexer or is best practice to have some type of collector such as a heavy forwarder onprem which will collect and forward to the cloud indexer?

trojan_81 · ‎02-02-2020

Within splunk cloud, I suspect we are whitelisting a list of approved snmp servers. I need to "whitelist" a new snmp server so it doesn't generate alerts. What would this list be called? Datasets? Where would I find this list so I can add another entry to it?

trojan_81 · ‎01-12-2020

Is there a way to tell if an app is a TA or a Dashboard? In case i'm not explaining it correctly: when i log into splunk cloud, there is a drop down with lots of installed application. Some apps will open into a nice dashboard while others do not open and you have to just run queries against it in the search. the ones that do not open a dashboard are called a TA?

trojan_81 · ‎01-02-2020

Thank you somesoni2. Looks like I am on UTC time. What does "strftime" stand for?

trojan_81 · ‎01-02-2020

Woodcock, When I drill into my username and then perferences I see the timezone is set to "Default System Timezone". Where can I find out what the default system timezone is?

trojan_81 · ‎01-02-2020

I meant to say the other way around. Is the TIME column reported in UTC time and the time within the event what the log source sent?

trojan_81 · ‎01-02-2020

Hello, When I'm looking at an event, there is a TIME field to the left column and then the actual event has it's own time listed as well. Is the TIME column using the clock from my PC and the Time within the event is the time reported by the log source?

trojan_81 · ‎12-19-2019

All, I want search a subnet over all indexes and sourcetypes. The subnet is 5.5.0.0/16 How would the query look so I can identify any IP within the 5.5.0.0/16 subnet? thanks in advance

trojan_81 · ‎12-03-2019

Hi suppose I have this IP address 10.5.5.5 I just want to see any information that splunk has on this IP. I'm starting with a wide search. What would the search query look like? If I simply type this in, it doesn't work: index=* 10.5.5.5 At minimum would that mean I need to specific a field for the IP address?

Posts	30
Solutions	0
Karma Given	0
Karma Received	4
Member Since	‎11-26-2019

Online Status	Offline
Date Last Visited	‎12-01-2021 01:54 PM

Eval function explanation

is splunk cloud or splunk enterprise capable of be...

splunk enterprise security

Microsoft o365 app for splunk

splunk cloud

data retention of sourcetype

index data retention

splunk search

view default index

splunkcloud smtp

Eval function explanation

Re: is splunk cloud or splunk enterprise capable o...

is splunk cloud or splunk enterprise capable of be...

Re: splunk enterprise security

splunk enterprise security

Microsoft o365 app for splunk

splunk cloud

data retention of sourcetype

index data retention

splunk search

view default index

splunkcloud smtp

Re: running log on splunk heavy forwarder

Re: What is the best practice for forwarding event...

running log on splunk heavy forwarder

Re: What is the best practice for forwarding event...

What is the best practice for forwarding events to...

how to view datasets

Splunk app

Re: splunk time stamp

Re: splunk time stamp

Re: splunk time stamp

splunk time stamp

splunk syntax search a subnet

splunk search query

Join the Conversation